AdvancedAuth Plugin API

Server-facing API endpoints used by the AdvancedAuth Minecraft plugin for authentication, session management, and email OTP.

https://plugins.zenuxs.in
Authentication: Plugin endpoints require an API key passed via the x-api-key header. The server key is sent via the x-server-key header. The player's real IP must be sent via the x-player-ip header for login and session validation.

Authentication & Sessions

GET /api/dataapikey/query API Key

Validate a player's password or session token. This is the primary authentication endpoint used by the plugin. Supports both password-based and session-based auth.

Query Parameters
ParamTypeRequiredDescription
tagstringYes*Username (not needed if sessionToken provided)
passwordstringYes*Password (not needed if sessionToken provided)
sessionTokenstringNoValidate an existing session instead of password
serverKeystringNoServer key to scope the query
Success Response (password)
{
    "valid": true,
    "exists": true,
    "username": "john",
    "email": "john@example.com",
    "isBanned": false,
    "timestamp": "23/06/2026, 14:30:45"
}
Success Response (session)
{
    "valid": true,
    "exists": true,
    "username": "john",
    "email": "john@example.com",
    "isBanned": false,
    "usingSession": true,
    "expiresAt": "2026-06-27T14:30:45.000Z"
}
POST /api/register API Key

Register a new player on the server.

Request Body
{
    "username": "john",
    "password": "securePass123",
    "email": "john@example.com",
    "licenseKey": "PREMIUM-2026-XXXXXX"
}
Success Response
{
    "message": "User registered successfully",
    "username": "john"
}
Error Response
{
    "error": "Username already taken for this server",
    "code": "USERNAME_TAKEN"
}
POST /api/login API Key

Authenticate a player and create a session. Rate-limited to 5000 req/15min. All previous sessions for the player are invalidated on new login.

Headers
HeaderRequiredDescription
x-api-keyYesYour API key
x-player-ipYesPlayer's real IP (set by plugin)
Request Body
{
    "username": "john",
    "password": "securePass123",
    "sessionDuration": 24,
    "premium": false
}
Success Response
{
    "message": "Login successful",
    "username": "john",
    "sessionToken": "a1b2c3d4e5f6...",
    "expiresIn": "24 hours",
    "premium": false,
    "ipAddress": "192.168.1.100",
    "timestamp": "23/06/2026, 14:30:45"
}
POST /api/validateSession API Key

Validate a session token with IP matching to prevent token theft.

Headers
HeaderRequiredDescription
x-api-keyYesYour API key
x-player-ipYesPlayer IP for security matching
Request Body
{ "sessionToken": "a1b2c3d4e5f6..." }
Success Response
{
    "valid": true,
    "username": "john",
    "email": "john@example.com",
    "expiresAt": "2026-06-24T14:30:45.000Z",
    "ipAddress": "192.168.1.100",
    "timeRemaining": 23.5
}
Error Responses
{ "valid": false, "error": "Invalid or expired session" }
{ "valid": false, "error": "IP mismatch - please login again" }
POST /api/logout API Key

Invalidate a single session token.

Request Body
{ "sessionToken": "a1b2c3d4e5f6..." }
Response
{ "success": true, "message": "Logged out successfully" }
POST /api/logoutAll API Key

Invalidate all sessions for a player globally or per-server.

Request Body
{
    "username": "john",
    "scope": "global"
}
Response
{ "success": true, "message": "All sessions invalidated" }
POST /api/autoLoginByIP API Key

Automatically log in a player by their IP address if they have an active session from that IP.

Request Body
{
    "ipAddress": "192.168.1.100"
}
POST /api/validateToken Public

Validate a server key token. Used by the plugin on startup to verify the server key is valid and the plugin is enabled.

Request Body
{ "token": "c126434b-eaf2-439a-a759-ca7600a7e146" }
Response
{
    "valid": true,
    "serverKey": "My Server",
    "pluginEnabled": true
}
GET /api/pluginStatus Server Key

Check if the plugin is enabled for the server key and return valid license information.

Response
{
    "enabled": true,
    "serverKey": "c126434b-...",
    "validLicenses": 2,
    "message": "Plugin is enabled"
}

Email & Password Reset

POST /api/setmail API Key

Set or update a player's email address.

Request Body
{
    "username": "john",
    "email": "john@example.com"
}
Response
{
    "success": true,
    "message": "Email updated successfully",
    "username": "john",
    "email": "john@example.com"
}
POST /api/changePassword/requestOTP Public

Request a one-time password reset OTP sent to the player's registered email.

Request Body
{ "email": "john@example.com" }
Response
{
    "success": true,
    "otp": "482915",
    "message": "OTP sent to your email"
}
POST /api/changePassword/verifyOTP Public

Verify OTP and set a new password.

Request Body
{
    "email": "john@example.com",
    "otp": "482915",
    "newPassword": "newSecurePass123"
}
Response
{ "success": true, "message": "Password changed successfully" }
POST /api/resetPasswordByUsername Public

Request a password reset OTP using username and server key instead of email.

Request Body
{
    "username": "john",
    "serverKey": "your-server-key"
}
Response
{ "success": true, "message": "OTP sent to your registered email" }
POST /api/verifyOTPByUsername Public

Verify OTP received via username-based reset and set a new password.

Request Body
{
    "username": "john",
    "otp": "482915",
    "newPassword": "newSecurePass123",
    "serverKey": "your-server-key"
}
Response
{ "success": true, "message": "Password changed successfully" }
POST /api/user/setEmail/requestOTP API Key

Request OTP to change a player's email address.

Request Body
{
    "username": "john",
    "newEmail": "newemail@example.com"
}
POST /api/user/setEmail/verifyOTP API Key

Verify OTP and update the email address.

Request Body
{
    "username": "john",
    "newEmail": "newemail@example.com",
    "otp": "482915"
}

Player Profile

GET /api/user/profile API Key

Get a player's profile including IP history and account age.

Query Parameters
ParamRequiredDescription
usernameYesThe player username
Response
{
    "username": "john",
    "email": "john@example.com",
    "createdAt": "2026-01-15T10:30:00.000Z",
    "lastLogin": "2026-06-23T14:30:45.000Z",
    "emailVerified": true,
    "totalLogins": 42,
    "uniqueIPs": 3,
    "accountAge": "160 days"
}
GET /api/user/sessions API Key

List all active sessions for a player.

Query Parameters
ParamRequiredDescription
usernameYesThe player username
Response
{
    "username": "john",
    "activeSessions": [
        {
            "ipAddress": "192.168.1.100",
            "createdAt": "2026-06-23T14:30:00.000Z",
            "expiresAt": "2026-06-24T14:30:00.000Z"
        }
    ],
    "totalSessions": 1
}
Rate Limiting: Public endpoints are limited to 1000 req/15min. Login endpoints are limited to 5000 req/15min.